neconyd | 0e795eaedae5e32594d34df2b5cd4d91d3442f15359de6b4e980b4eb8644fd39

Analysis

max time kernel
115s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25/11/2024, 23:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e795eaedae5e32594d34df2b5cd4d91d3442f15359de6b4e980b4eb8644fd39N.exe
Size

134KB
MD5

fb41407c183c1dcd0abdf8a420899d80
SHA1

6d14527465cf44fb75034ff6b64633829ff86ed3
SHA256

0e795eaedae5e32594d34df2b5cd4d91d3442f15359de6b4e980b4eb8644fd39
SHA512

36c37fe8774e98b90ab9c846fcd12d397447914e4dde76c30fcc46ac60c7b95097f5485eea83834e9b60cf4432e231c5040d075bcc2fc920a8e68231a2514edb
SSDEEP

1536:BDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCia:hiRTeH0iqAW6J6f1tqF6dngNmaZCia

Score

10^/10

neconyd discovery trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd
Neconyd family
neconyd

Executes dropped EXE 6 IoCs

pid	Process
3688	omsecor.exe
452	omsecor.exe
2464	omsecor.exe
3184	omsecor.exe
1228	omsecor.exe
3968	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4768 set thread context of 1756	4768	0e795eaedae5e32594d34df2b5cd4d91d3442f15359de6b4e980b4eb8644fd39N.exe	83
PID 3688 set thread context of 452	3688	omsecor.exe	88
PID 2464 set thread context of 3184	2464	omsecor.exe	108
PID 1228 set thread context of 3968	1228	omsecor.exe	112

Program crash 4 IoCs

pid	pid_target	Process	procid_target
1160	4768	WerFault.exe	82
3612	3688	WerFault.exe	85
736	2464	WerFault.exe	107
4336	1228	WerFault.exe	110

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0e795eaedae5e32594d34df2b5cd4d91d3442f15359de6b4e980b4eb8644fd39N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omsecor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0e795eaedae5e32594d34df2b5cd4d91d3442f15359de6b4e980b4eb8644fd39N.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 1756	4768	0e795eaedae5e32594d34df2b5cd4d91d3442f15359de6b4e980b4eb8644fd39N.exe	83
PID 4768 wrote to memory of 1756	4768	0e795eaedae5e32594d34df2b5cd4d91d3442f15359de6b4e980b4eb8644fd39N.exe	83
PID 4768 wrote to memory of 1756	4768	0e795eaedae5e32594d34df2b5cd4d91d3442f15359de6b4e980b4eb8644fd39N.exe	83
PID 4768 wrote to memory of 1756	4768	0e795eaedae5e32594d34df2b5cd4d91d3442f15359de6b4e980b4eb8644fd39N.exe	83
PID 4768 wrote to memory of 1756	4768	0e795eaedae5e32594d34df2b5cd4d91d3442f15359de6b4e980b4eb8644fd39N.exe	83
PID 1756 wrote to memory of 3688	1756	0e795eaedae5e32594d34df2b5cd4d91d3442f15359de6b4e980b4eb8644fd39N.exe	85
PID 1756 wrote to memory of 3688	1756	0e795eaedae5e32594d34df2b5cd4d91d3442f15359de6b4e980b4eb8644fd39N.exe	85
PID 1756 wrote to memory of 3688	1756	0e795eaedae5e32594d34df2b5cd4d91d3442f15359de6b4e980b4eb8644fd39N.exe	85
PID 3688 wrote to memory of 452	3688	omsecor.exe	88
PID 3688 wrote to memory of 452	3688	omsecor.exe	88
PID 3688 wrote to memory of 452	3688	omsecor.exe	88
PID 3688 wrote to memory of 452	3688	omsecor.exe	88
PID 3688 wrote to memory of 452	3688	omsecor.exe	88
PID 452 wrote to memory of 2464	452	omsecor.exe	107
PID 452 wrote to memory of 2464	452	omsecor.exe	107
PID 452 wrote to memory of 2464	452	omsecor.exe	107
PID 2464 wrote to memory of 3184	2464	omsecor.exe	108
PID 2464 wrote to memory of 3184	2464	omsecor.exe	108
PID 2464 wrote to memory of 3184	2464	omsecor.exe	108
PID 2464 wrote to memory of 3184	2464	omsecor.exe	108
PID 2464 wrote to memory of 3184	2464	omsecor.exe	108
PID 3184 wrote to memory of 1228	3184	omsecor.exe	110
PID 3184 wrote to memory of 1228	3184	omsecor.exe	110
PID 3184 wrote to memory of 1228	3184	omsecor.exe	110
PID 1228 wrote to memory of 3968	1228	omsecor.exe	112
PID 1228 wrote to memory of 3968	1228	omsecor.exe	112
PID 1228 wrote to memory of 3968	1228	omsecor.exe	112
PID 1228 wrote to memory of 3968	1228	omsecor.exe	112
PID 1228 wrote to memory of 3968	1228	omsecor.exe	112

C:\Users\Admin\AppData\Local\Temp\0e795eaedae5e32594d34df2b5cd4d91d3442f15359de6b4e980b4eb8644fd39N.exe
"C:\Users\Admin\AppData\Local\Temp\0e795eaedae5e32594d34df2b5cd4d91d3442f15359de6b4e980b4eb8644fd39N.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Users\Admin\AppData\Local\Temp\0e795eaedae5e32594d34df2b5cd4d91d3442f15359de6b4e980b4eb8644fd39N.exe
  C:\Users\Admin\AppData\Local\Temp\0e795eaedae5e32594d34df2b5cd4d91d3442f15359de6b4e980b4eb8644fd39N.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1756
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3688
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:452
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2464
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3184
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1228
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3968
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 240
        8⤵
        Program crash
        
        PID:4336
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 292
        6⤵
        Program crash
        
        PID:736
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 300
      4⤵
      Program crash
      PID:3612
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 288
  2⤵
  - Program crash
  PID:1160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4768 -ip 4768
1⤵
PID:1296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3688 -ip 3688
1⤵
PID:1424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2464 -ip 2464
1⤵
PID:3296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1228 -ip 1228
1⤵
PID:5044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
134KB

MD5
df0aca76782333e66c524a4712828cee

SHA1
4028b5bc4f374f0e0a68907f2ced4a60c6439783

SHA256
fed9a91f185a5b3bd1cde2a79e13eb441da355186a94712459559ddf69dcb2cd

SHA512
96c6587203834a530e71f6f1826056044081a7c0e54ea5ad2275b25f7daa18d5e7cc26000c389140645b7c28aed3bfe4dd42f283363ff0881631e7e0304e25ea

Download Submit
C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
134KB

MD5
113374a0b473bb07886bc0d67f6a5b2c

SHA1
40043675fbb210120ecd340342326a82bf7045bf

SHA256
cff8e03ab7766fc72006b978a59dd04956da0ec99e2c0fb86fc503d97b74129d

SHA512
5561a61a12fdf4381f3c85860fc6b24d6c8047928f30c62656818877bbc9ec64b947e9a3f4ed727f0927a87fe7fae6e8cd966bba8a1ada97256af81b6f8f1259

Download Submit
C:\Windows\SysWOW64\omsecor.exe

Filesize
134KB

MD5
480a9504a67b322c38db003a76575e5a

SHA1
b4b09fcf4cb7d7a57e623957cd7a8f8741e0c1af

SHA256
a82e6a664ddfdfd4b728bf2e65ff01e5b7e2408fe25558095ab2c5639826fc6c

SHA512
1a3cd588c53255230cfb1edea7bab472247e7cc2f059ba5098be4eaed64fe4f96d390c68a7c003c09a1c53ded2cea90527c1013db6ba16919563b4205139b06a

Download Submit
memory/452-14-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/452-24-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/452-29-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/452-25-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/452-15-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/452-21-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/452-18-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1228-42-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1756-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1756-3-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1756-11-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1756-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2464-30-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2464-49-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3184-36-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3184-38-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3184-35-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3688-16-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3688-7-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3968-48-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3968-47-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3968-50-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4768-0-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4768-17-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download